Cybersecurity
353 articles RSS
OpenSSH 10.6p2 Fixes a Password Authentication Bypass Affecting musl-Based Linux Systems With PAM Disabled, Including Alpine Linux
OpenSSH's 10.6p2 release, dated 2026-11-05, works around a password bypass on musl-based Linux without PAM; BleepingComputer names Alpine Linux among affected systems.
CVE-2026-111497: One Brotli Decoder Flaw Reached Node.js, .NET, Python Packages and Others Through Separate Bundled Copies
Reporting on the Brotli decoder flaw CVE-2026-111497 shows fixes, scanner coverage and exploitation status differing across Node.js, .NET, Python packages and others.
Chrome 157 Stable Carries 213 Security Fixes, Seven Rated Critical, Including Two in Dawn and One Each in ANGLE and WebGL
Google promoted Chrome 157 to stable with 213 security fixes, seven rated critical; SecurityWeek reports no mention of exploitation in the wild.
GitHub Actions Will Block pull_request_target by Default in Public Repositories From December 2, With Brownouts on November 9 and 16
GitHub's November 2 changelog says Actions will block pull_request_target by default in public repositories from December 2, 2026, after brownouts on November 9 and 16, unless an event policy allows it.
PostgreSQL Anonymizer 3.3 fixes 12 CVEs that Dalibo calls critical; CVE records score them 3.5 to 6.5
Dalibo's PostgreSQL Anonymizer 3.3 fixes 12 CVEs. Its announcement calls them critical; the CVE records give CVSS 3.1 base scores of 3.5 to 6.5, and none of the records mentions superuser access, which the announcement cites.
Rails 8.1.4.1 and 8.0.5.2 Fix 21 Security Issues, Led by a Critical Active Storage ImageMagick File-Write Flaw, GHSA-f3w6-w445-fwh9
Rails says 8.1.4.1 and 8.0.5.2 fix 21 issues; the advisory for the Critical one says a crafted upload may let an unauthenticated attacker write files via ImageMagick.
Gitea 28.3.0 Lists 21 CVE Identifiers, Mostly Around Token Scopes, and Moves Review-Triggered Workflows to the Pull Request Head
Gitea's release post for 28.3.0 lists 21 CVE identifiers by the Herald's count, mostly around token scopes, including one where review-triggered workflows ran from a reviewer-chosen commit. Linuxiac's headline says 20.
Elixir 1.20.5, 1.19.7 and 1.18.6 Fix Two Denial-of-Service CVEs in URI.parse and JSON.decode; 1.20.5 Also Fixes a Mix deps.partition Flaw
Elixir 1.20.5 lists three CVE fixes in its security notes; 1.19.7 and 1.18.6 carry the URI and JSON fixes. CVE records rate each Medium under CVSS 4.0.
OCaml 5.5.2 Fixes Six OSEC Advisories, Including Marshal Demarshaling and Windows Command Quoting; Each Advisory Credits Anthropic as Reporter
OCaml 5.5.2, tagged October 23, 2026, fixes six OSEC advisories in Str, Unix.map_file, Marshal, Windows command quoting and runtime_events, plus four other bugs including two miscompilations.
Cursor Says Malicious Anthropic.claude-code Versions 2.1.312 and 2.1.313 Were Offered in Its Marketplace and Tried to Install an SSH Backdoor
Cursor says modified Claude Code extension versions 2.1.312 and 2.1.313 were available in its VS Code extension marketplace on October 29 and tried to install an SSH backdoor; it says Anthropic did not develop them and reports it removed them and rotated keys.
psqlODBC 18.00.0006 Fixes Vulnerabilities Including an SQL Injection in SQLSpecialColumns and Several Buffer Overflows; All Earlier Releases Affected
The PostgreSQL ODBC project released psqlODBC 18.00.0006 on November 2; its changelog lists CVE-2026-120057 through CVE-2026-120067 and says all earlier releases are affected.
Hacktron Reports a GNU Savannah Flaw That Could Have Given Push Access to Bash, and Says the FSF Fixed 26 Vulnerabilities in the Forge
Hacktron's write-up says a shell injection in the Savane forge software behind GNU Savannah, reported to the FSF on May 11, 2026, could have been chained to push access to Bash; the firm says it did not touch the repository.